Refer to the exhibits. Which include debug output and SSL VPN configuration details. An SSL VPN has been configured on FortiGate. To enhance security, the administrator enabled Required Client…

Question

Exhibits

Options

• AEnable Redirect HTTP to SSL-VPN on the SSL VPN configuration page.
• BImport the CA that signed the SSL VPN Server Certificate to FortiGate.
• CSet the user certificate as the Server Certificate on the SSL VPN configuration page.
• DImport the CA that signed the user certificate to FortiGate.

• A
  4% (1)
• B
  4% (1)
• C
  9% (2)
• D
  83% (19)

Explanation

The SSL-VPN configuration hasRequire Client Certificateenabled. When this is enabled, FortiOS performs two checks: Normal user authentication(username/password or PKI user) Additional client certificate check?the client certificatemust be signed by a CA that FortiGate FortiOS documentation for "SSL VPN with certificate authentication" states: "The client certificate only needs to be signed by a known CA in order to pass authentication." "The CA certificate is the certificate that signed both the server certificate and the user certificate... The CA certificate is available to be imported on the FortiGate." The debug output shows key lines: _quick_check_peer-CA does not match. Issuer of cert depth 0 is not detected in CMDB. FortiGatedoes see the user's certificate, Butcannot find the issuing CAin its local CA certificate store ("CMDB" = configuration database). This means theCA that signed the user certificate has not been importedinto FortiGate.

No community discussion yet for this question.